Vendor and Supplier Security Checks for Small Businesses
Your security is only as strong as the suppliers who hold your data, log into your systems or send you invoices. This checklist shows a small business how to check vendors in proportion to the risk, without sending 200-question surveys nobody answers.
Key takeaways
- Start with a simple list of every supplier that holds your data, accesses your systems or receives your payments.
- Rank suppliers by risk and spend your effort on the few that could really hurt you.
- Ask a short set of questions about MFA, backups, updates, access and how they will tell you about an incident.
- Give suppliers the least access they need, and remove it promptly when the work ends.
- Review high-risk suppliers every year and whenever something changes.
Most small businesses depend on a long chain of outside providers: an IT support company, an accountant, a payroll bureau, a cloud accounting app, a web developer, a marketing agency, a card payment provider and a dozen software subscriptions. Each of them holds a piece of your business. Some have the keys to your systems. If one of them is breached, your data, your customers and your money can be affected even though your own security is in good shape.
Big companies run formal supplier risk programs with dedicated teams. You do not need one, but you do need a repeatable way to decide which suppliers matter most and what to ask them. This checklist gives you that. It is general information, not legal advice: if a supplier handles personal data, data protection rules apply to how you choose and contract with them, so check the ICO guidance (UK), your national supervisory authority (EU) or a qualified adviser.
Step 1: list every supplier that touches your data, systems or money
You cannot check suppliers you have forgotten about. Spend an hour building a simple spreadsheet. Good places to look are your bank statements, card statements, accounting software and the list of apps connected to your email or cloud accounts.
For each supplier, record:
- What they do for you and who in your business manages the relationship
- What data they hold, especially personal data about customers or staff
- What access they have: admin accounts, remote access tools, shared logins, office keys
- Whether you send them payments, and how bank details were confirmed
- The contract or terms you signed, and the renewal date
Pro tip
Check the "connected apps" or "third-party access" page in your email, cloud storage and social media accounts. You will often find old tools, plugins and integrations that still have access to your data long after anyone stopped using them. Remove the ones you do not need.
Step 2: rank suppliers by risk
Not every supplier needs the same scrutiny. Your stationery supplier and your managed IT provider are not in the same league. Sort your list into three tiers.
| Tier | Typical suppliers | Level of checking |
|---|---|---|
| High | IT provider with admin access, payroll bureau, cloud systems holding customer or staff data, payment providers | Full questions, contract review, annual check |
| Medium | Marketing agency with access to your email list or social accounts, web developer, accountant | Core questions and access limits |
| Low | Suppliers with no data, no system access and routine payments only | Bank detail verification and basic due diligence |
Ask two questions for each supplier: "What could they see or change?" and "What would happen to us if they were breached or went offline for a week?" The suppliers with the most worrying answers are your high tier.
Step 3: ask the right security questions
A short, focused questionnaire gets better answers than a long one. For high and medium tier suppliers, ask these in writing and keep the replies.
Accounts and access
- Do your staff use multi-factor authentication for systems that hold our data or access our systems?
- Who in your company can access our data, and how is that access limited and reviewed?
- Do you use individual named accounts rather than shared logins?
- How do you remove access when one of your staff leaves?
Protection and recovery
- How quickly do you apply security updates?
- Do you use malware protection on your devices?
- How do you back up our data, and have you tested restoring it?
- Where is our data stored, and do you use subcontractors who can access it?
Incidents and certification
- Will you tell us promptly if you have a security incident affecting our data or systems, and who will contact us?
- Do you hold a security certification? In the UK, Cyber Essentials or Cyber Essentials Plus is a common baseline for small suppliers.
- Can we get our data back, in a usable format, if we end the contract, and how will you delete it?
Cyber Essentials is a UK government-backed scheme covering five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Certificates must be renewed every 12 months, so check the date as well as the logo. It does not prove a supplier is perfectly secure, but it is a useful sign that the basics are in place.
Common mistake
Accepting "We take security very seriously" as an answer. Ask for specifics. A good supplier will happily tell you whether they use MFA, how they back up and who to call in an incident. Vague answers to simple questions are a warning sign in themselves.
Step 4: put it in the contract
Security promises are much stronger when they are written down. For high tier suppliers, and anyone handling personal data on your behalf, check that your contract or their standard terms cover:
- What data they process, for what purpose, and that they only act on your instructions
- Confidentiality and appropriate security measures
- Prompt notification to you of any incident affecting your data, so you can meet your own deadlines, such as the 72-hour window for reporting a notifiable personal data breach to the ICO under UK GDPR
- Rules on using subcontractors
- Return or deletion of your data when the contract ends
Many established software providers publish standard data processing terms. Read them rather than assuming. If you are unsure whether your contracts meet data protection requirements, check the ICO guidance on contracts with processors or speak to a qualified adviser.
Step 5: control supplier access in practice
Good paperwork does not help if the supplier logs in with a shared admin password that has not changed in five years. Manage access as carefully as you do for your own staff.
- Named accounts only: give each supplier person their own account, never your own login or a shared one.
- Least privilege: grant only the access they need for the job, for example editor rather than owner on your website or ad account.
- MFA required: insist on multi-factor authentication for any supplier account on your systems.
- Time-limited access: for one-off projects, set an end date or switch remote access on only when needed.
- Keep ownership: make sure your business, not the supplier, owns your domain name, website hosting, social media accounts and ad accounts.
- Remove promptly: when a project ends or a supplier changes, remove their accounts and change any passwords they knew.
Example
Imagine a small online retailer, Meadow & Moss, that hired a freelance developer two years ago to build its website. During a supplier review, the owner finds the developer still has an administrator account on the website and is listed as the owner of the domain name. Nothing has gone wrong, but if the developer's email were compromised, the attacker could take over the whole shop. The owner transfers the domain into the business's name, downgrades the developer's account to a time-limited editor role for ongoing work, and turns on MFA. The fix takes an afternoon.
Step 6: protect payments to suppliers
Suppliers are a favorite disguise for fraudsters. Criminals impersonate a real supplier, sometimes from that supplier's own compromised mailbox, and ask you to pay a new bank account. Build these controls into how you manage every supplier, whatever their tier.
- Record bank details and a trusted phone number for each supplier at onboarding
- Verify any change of bank details by calling a known number from your own records, never one in the email
- Use a two-person rule for adding or changing payees and a cooling-off period before the first payment to new details
- In the UK, treat a Confirmation of Payee "no match" as a reason to stop and check
Our guide to payment redirection fraud covers this process step by step.
Step 7: review and offboard suppliers
Supplier checks are not a one-off task. Businesses change, staff change and suppliers get bought, merge or start using new subcontractors.
- Review high tier suppliers every year, including their certification dates and your access list
- Review a supplier whenever their service, ownership or access changes
- Ask what happened if a supplier reports an incident, and whether your data was involved
- When you end a contract, get your data back, ask for deletion in writing and remove all access the same day
Your vendor security checklist
- Supplier list with data, access, payments and contract dates
- Old connected apps and integrations removed
- Every supplier ranked high, medium or low risk
- Security questions sent to high and medium tier suppliers, answers kept
- Cyber Essentials or other certification checked, including the renewal date
- Contracts cover security, incident notification, subcontractors and data return
- Named supplier accounts with MFA and least privilege
- Your business owns its domain, hosting, social and ad accounts
- Bank detail changes verified by call-back with two-person approval
- Annual review of high tier suppliers and same-day offboarding
Frequently asked questions
Do small businesses really need to check supplier security?
Yes, especially for suppliers that hold personal data or can log into your systems. A breach at your IT provider, payroll bureau or web developer can affect you directly. Checks can be short and proportionate to the risk.
What is the most important question to ask a supplier?
If you ask only one, ask whether they use multi-factor authentication on systems that hold your data or access your systems, and how they will tell you about an incident. The answers say a lot about their overall approach.
Should I only use suppliers with Cyber Essentials?
It is a useful sign for UK suppliers, and some UK government contracts require it, but it is not the only measure. Many good suppliers outside the UK use other certifications or can answer your questions clearly. Use certification as one input alongside your own questions.
How often should I review my suppliers?
Review high risk suppliers at least once a year and whenever their service, ownership or access changes. Lower risk suppliers can be reviewed less often, but keep verifying any bank detail changes every time.
Related reading
The bottom line
Vendor security checks for a small business do not need to be bureaucratic. List your suppliers, rank them by risk, ask the high tier a few specific questions, write the important promises into contracts and keep their access tight. Protect every supplier payment with a call-back rule.
Start with the list this week. Just seeing who holds your data and who can log into your systems will show you where the biggest gaps are.
